PVC-devices, e.g. personal digital assistants, mobile phones, chipcards etc., are frequently used to gather information or to use business transactions applications stored on server, e.g. application for electronic payments or application for electronic shopping.
Wireless PVC-devices like personal digital assistants and mobile phones communicate via gateway and Internet to a server which offers access to Web pages or business transaction application. Other PVC-devices like chipcards may use a LAN, Intranet or Internet to communicate with the said server.
A main problem of communication between different PVC-devices and the business transaction applications is the security. Normally each business transaction application may use its own security requirements depending on the type of PVC-device, the type of user and type of communication.
Security requirements may consist of an authentication level, a confidentiality level and an endorsement level. PVC-devices can establish a certain authentication level by performing appropriate authentication protocol and a certain level of confidentiality by employing appropriate encryption to secure communication between the server and certain level of endorsement.
Today, to applicant's knowledge, no secure, integrated solution for security based access control from various PVC-devices to applications/functions on a server exists. Applications are mostly developed to support few devices. Security requirements and authentication code are mostly buried in the application code.
In current PVC-applications, it is difficult to add support for additional PVC-devices and authentication mechanism. In most cases, applications allow for at most one authentication mechanism, mostly coupled with an application.
It is therefore the object of the present invention to provide a system and method for a security based access control from various PVC-devices to applications which is independent from any client or application.
This object is solved by the features of the independent claims. Preferred embodiments of the present invention are laid down in the dependent claims.